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Abstract 

We show how one may establish proof-theoretic results for constructive 
Zermelo-Fraenkel set theory, such as the compactness rule for Cantor 
space and the Bar Induction rule for Baire space, by constructing sheaf 
models and using their preservation properties. 

1 Introduction 

This paper is concerned with Aczel's predicative constructive set theory CZF 
and with related systems for predicative algebraic set theory; it also studies 
extensions of CZF, for example by the axiom of countable choice. 

We are particularly interested in certain statements about Cantor space 
2 N , Baire space N N and the unit interval [0, 1] of Dedekind real numbers in 
such theories, namely the compactness of 2 N and of [0, 1], and the related "Bar 
Induction" property for Baire space. The latter property states that if S is a 
set of finite sequences of natural numbers for which 

- for each a there is an n such that (cv(0), a(l), a(n)) belongs to S ( U S 
is a bar"), 

- if u belongs to S then so does every extension of u ( "S 1 is monotone" ) , 

- if u is a finite sequence for which the concatenation u * n belongs to 5* for 
all n, then u belongs to S ("S 1 is inductive"), 

then the empty sequence ( ) belongs to S. It is well-known that these statements, 
compactness of 2 N and of [0, 1] and Bar Induction for N N , cannot be derived in 
intuitionistic set or type theories. In fact, they fail in sheaf models over locales, 
as explained in [17] . Sheaf models can also be used to show that all implications 
in the chain 

(BI) => (FT) (HB) 
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are strict (where BI stands for Bar Induction for N N , while FT stands for the 
Fan Theorem (compactness of 2 N ) and HB stands for the Heine-Borel Theorem 
(compactness of the unit interval), see [2"7]V 

On the other hand, one may also define Cantor space C, Baire space B, 
and the unit interval I as locales or formal spaces. Compactness is provable 
for formal Cantor space, as is Bar Induction for formal Baire space. Although 
Bar Induction may seem to be a statement of a slightly different nature, it is 
completely analogous to compactness, as explained in |17j as well. Indeed, the 
locales C and I have enough points (i.e., are true topological spaces) iff the 
spaces 2 N and [0, 1] are compact, while the locale B has enough points iff Bar 
Induction holds for the space N N . The goal of this paper is to prove that the 
compactness properties of these (topological) spaces do hold for CZF (with 
countable choice), however, when they are reformulated as derived rules. Thus, 
for example, Cantor space is compact in the sense that if S is a property of 
finite sequences of 0's and l's which is definable in the language of set theory 
and for which CZF proves 

for all a in 2 N there is an n such that (a(0), a(l), a(n)) belongs 
to S ("S is a cover"), 

then there are such finite sequences iti, ...,Uk for which CZF proves that each 
Ui belongs to S as well as that for each a as above there are an n and an i such 
that (a(0), a(l), a(n)) — u%. We will also show that compactness of the unit 
interval and Bar Induction hold when formulated as derived rules for CZF and 
suitable extensions of CZF, respectively. 

This is a proof-theoretic result, which we will derive by purely model-theoretic 
means, using sheaf models for CZF and a doubling construction for locales orig- 
inating with Joyal. Although our results for the particular theory CZF seem 
to be new, similar results occur in the literature for other constructive systems, 
and are proved by various methods, such as purely proof-theoretic methods, 
realizability methods or our sheaf-theoretic methods^ In this context it is im- 
portant to observe that derived rules of the kind "if T proves if, then T proves 
if>" are different results for different T, and can be related only in the presence 
of conservativity results. For example, a result for CZF like the ones above 
does not imply a similar result for the extension of CZF with countable choice, 
or vice versa. 

Our motivation to give detailed proofs of several derived rules comes from 
various sources. First of all, the related results just mentioned predate the the- 

1 Fov example, Beeson in [6] used a mixture of forcing and realizability for Feferman-style 
systems for explicit mathematics. Hayashi used proof-theoretic methods for HAH, the system 
for higher-order Heyting arithmetic corresponding to the theory of elementary toposes in 1231 . 
and sheaf-theoretic methods in [24| for the impredicative set theory IZF, an intuitionistic 
version of Zermelo-Fraenkel set theory. Grayson T2 gives a sheaf-theoretic proof of a local 
continuity rule for the system HAH, and mentions in [21 1 that the method should also apply 
to systems without powerset. 
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ory CZF, which is now considered as one of the most robust axiomatisations 
of predicative constructive set theory and is closely related to Martin-L6f type 
theory [TJ[21[3]. Secondly, the theory of sheaf models for CZF has only recently 
been firmly established (see [TH1 [Ml H2] ) , partly in order to make applications 
to proof theory such as the ones exposed in this paper possible. Thirdly, the 
particular sheaf models over locales necessary for our application hinge on some 
subtle properties and constructions of locales (or formal spaces) in the predica- 
tive context, such as the inductive definition of covers in formal Baire space in 
the absence of power sets. These aspects of predicative locale theory have only 
recently emerged in the literature [THH]. In these references, the regular exten- 
sion axiom REA plays an important role. In fact, one needs an extension of 
CZF, which on the one hand is sufficiently strong to handle suitable inductive 
definitions, while on the other hand it is stable under sheaf extensions. One 
possible choice is the extension of CZF by the smallness axiom for W-types 
and the axiom of multiple choice AMC (see |13jV 

The results of this paper were presented by the authors on various occasions: 
by the second author in July 2009 at the TACL'2009 conference in Amsterdam 
and in March 2010 in the logic seminar in Manchester and by the first author 
in May 2010 at the meeting "Set theory: classical and constructive", again in 
Amsterdam. We would like to thank the organizers of all these events for giving 
us these opportunities. We are also grateful to the referee for a very careful 
reading of the original manuscript and to the editors for their patience. 

2 Constructive set theory 

Throughout the paper we work in Aczel's constructive set theory CZF, or ex- 
tensions thereof. (An excellent reference for CZF is [5].) 

2.1 CZF 

CZF is a set theory whose underlying logic is intuitionistic and whose axioms 
are: 

Extensionality: Vi(xeaf>iei))->a = !). 

Empty set: 3x\/y^y € x. 

Pairing: 3xVy (y € x -H- y = a V y = b). 

Union: BxVy (y € x 3z E ay € z). 

Set induction: V;r (Vy £ X(p(y) — > f(x)) — » Mxip(x). 

Infinity: 3a((3j;i e a) A (Vi £ a3j/ € ai 6 j/)). 
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Bounded separation: 3xVy ( y € x •<-> y £ aA<f(y) ) , for any bounded formula 
<y3 in which a does not occur. 

Strong collection: Vx £ a3y ip(x,y) — > 3bB(x E a,y e b) tp. 

Subset collection: 3c\/z{\/x G a Ely G b(p(x,y,z) — > 3d G cB(x G a, y G 
d) ^(x, y, z) ) . 

In the last two axioms, the expression 

B(x G a,y E b) ip. 

has been used as an abbreviation for Vx G a Ely G b (p A Vy G b 3x G a 

Throughout this paper, we will use denumerable to mean "in bijective cor- 
respondence with the set of natural numbers" and finite to mean "in bijective 
correspondence with an initial segment of natural numbers" . A set which is 
either finite or denumerable, will be called countable. In addition, we will call 
a set K-finite, if it is the surjective image of an initial segment of the natural 
numbers. Observe that if a set has decidable equality, then it is finite if and 
only if it is K-finitc. 

In this paper we will also consider the following choice principles (countable 
choice and dependent choice): 

AC W (Vn G N)(3x G X)ip(n, x) -> (3f: N -¥ JQ(Vn G N) ip(n, f(n)) 

DC (Vx e X)(3y e X)ip(x,y) ^ 

(Vx G X) (E!/: N -> X) [ /(0) = x A (Vn G N) <p(f(n), f(n + 1)) ] 

It is well-known that DC implies AC W , but not conversely (not even in ZF). 
Any use of these additional axioms will be indicated explicitly. 

2.2 Inductive definitions in CZF 

Definition 2.1 Let S be a class. We will write Pow(S') for the class of subsets 
of S. An inductive definition is a subclass $ of Pow(5) x S. One should think 
of the pairs (X, a) G $ as rules of the kind: if all elements in X have a certain 
property, then so does a. Accordingly, a subclass A of S will be called ^-closed, 
if 

whenever (X, a) is in 

In CZF one can prove that for any inductive definition $ on a class £ and 
for any subclass U of S there is a least $-closed subclass of S containing U 
(see [5]). We will denote this class by /(<&,[/). However, for the purposes of 
predicative locale theory one would like to have more: 
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Theorem 2.2 (Set Compactness) If S and $ are sets, then there is a subset 
B of Pow(S') such that for each set U C S and each a G U) there is a set 
V e B such that V C U and a G /($, V). 

This result cannot be proved in CZF proper, but it can be proved in ex- 
tensions of CZF. For example, this result becomes provable in CZF extended 
with Aczel's regular extension axiom REA [5] or in CZF extended with the 
axioms WS and AMC 13 . The latter extension is known to be stable under 
sheaves [5^1 [T3] , while the former presumably is as well. Below, we will denote 
by CZF + any extension of CZF which allows one to prove set compactness and 
which is stable under sheaves. 



3 Predicative locale theory 

In this section we have collected the definitions and results from predicative 
locale theory that we need in order to establish derived rules for CZF. We have 
tried to keep our presentation self-contained, so that this section can actually be 
considered as a crash course on predicative locale theory or "formal topology" . 
(In a predicative context, locales are usually called "formal spaces" , hence the 
name. Some important references for formal topology are [TH1 HH GUI H] and, 
unless we indicate explicitly otherwise, the reader may find the results explained 
in this section in these sources.) 

3.1 Formal spaces 

Definition 3.1 A formal space is a small site whose underlying category is 
a preorder. By a preorder, we mean a set P together with a small relation 
<C PxP which is both reflexive and transitive. If a is an element of P then we 
will write J, a or M a for {p G P : p < a}, and if a is a subset of P then we will 
write J. a = {p G P: (3a G a)p < a}. For the benefit of the reader, we repeat 
the axioms for a site from |12) for the special case of preorders. 

Fix an element a G P. By a sieve on a we will mean a downwards closed 
subset of -J, a. The set M a = J, a will be called the maximal sieve on a. In a 
predicative setting, the sieves on a form in general only a class. 

If S is a sieve on a and b < a, then we write b*S for the sieve 

b*S = S(llb 

on b. We will call this sieve the restriction of S to b. 

A (Grothendieck) topology Cov on P is given by assigning to every object 
a G P a collection of sieves Cov(a) such that the following axioms are satisfied: 

(Maximality) The maximal sieve M a belongs to Cov(a). 
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(Stability) If S belongs to Cov(a) and b < a, then b*S belongs to Cov(b). 

(Local character) Suppose S is a sieve on a. If R G Cov(a) and all restrictions 
b*S to elements b G R belong to Cov(6), then S € Cov(a). 

A pair (P, Cov) consisting of a preorder P and a Grothendieck topology Cov on 
it is called a formal topology or a formal space. If a formal topology (P, Cov) 
has been fixed, the elements of P will be referred to as basic opens or basis 
elements and the sieves belonging to some Cov(a) will be referred to as the 
covering sieves. If S belongs to Cov(a) one says that 5* is a sieve covering a, or 
that a is covered by S. 

To develop a predicative theory of locales one needs to assume that the 
formal spaces one works with have a presentation, in the following sense. (Note 
that it was a standing assumption in |12j that sites had a presentation.) 

Definition 3.2 A presentation for a formal topology (P, Cov) is a function 
BCov assigning to every a 6 P a small collection of basic covering sieves 
BCov(a) such that: 

S G Cov(a) <^3Re BCov(a): R C S. 
A formal topology which has a basis will be called presentable. 

One of the ways in which presentable formal spaces behave better than gen- 
eral ones, is that, in CZF, only presentable formal spaces give rise to categories 
of sheaves again modelling CZF (see Theorem 14.31 and Remark 14.41 below) . For 
this reason, it will be an important theme in this section to sort out whether the 
concrete formal spaces we work with can be proved to be presentable in CZF 
or in extensions thereof. 

Remark 3.3 Another property of presentable formal spaces, which is some- 
times useful, is that for a given sieve S the collection of a G P which are covered 
by S form a set, as it can be written as 

{a G P : (BR G BCov(a)) (W G R) r G S}. 

This property is often included in the definition of a formal space, but for our 
purposes this was not necessary. (We thank Giovanni Curi for bringing this 
issue to our attention; see also [15].) 

3.2 Inductively generated formal topologies 

Definition 3.4 If P is a preorder, then a covering system is a map C assigning 
to every a G P a small collection C(a) of subsets of 4- a such that the following 
covering axiom holds: 



G 



for every a G C(p) and q < p, there is a /3 G C(g) such that 
/3 C g*(4. a) = {r < q : (3a e a) r < a}. 

Every covering system generates a formal space. Indeed, every covering 
system gives rise to an inductive definition $ on P, given by: 

$ = {(a, a) : a G C(a)}. 

So we may define: 

S G Cov(a) «d£ I(®,S). 
Before we show that this is a Grothendieck topology, we first note: 

Lemma 3.5 If S is a downwards closed subclass of I a, then so is /($, S). 
Also, x e J($, S) iffxe /($, 

Proof. The class /($, 5 1 ) is inductively generated by the rules: 

r£S aC/(<f,S) ctgC(r) 

re/(i,s) re/($,s) 

Both statements are now proved by an induction argument, using the covering 
axiom. □ 



Theorem 3.6 Every covering system generates a formal topology. More pre- 
cisely, for every covering system C there is a smallest Grothendieck topology 
Cov such that 

a G C(a) =>| a E Cov(a). 
In CZF+ one can show that this formal topology has a presentation. 

Proof. Note that the Cov relation is inductively generated by: 

a£S aeC(a) (Vxgq) x'SgCov(x) 

5GCov(a) SGCov(a) 

Maximality is therefore immediate, while stability and local character can be 
established using straightforward induction arguments. Therefore Cov is indeed 
a topology. The other statements of the theorem are clear. □ 



Theorem 3.7 (Induction on covers) Let (P, Cov) be a formal space, whose 
topology Cov is inductively generated by a covering system C, as in the pre- 
vious theorem. Suppose P(x) is a property of basis elements x G P, such that 

Va€C(x)(((Vyea)P(y))^P(x)), 

and suppose S is a cover of an element a eP such that P(y) holds for all y G S. 
Then P{a) holds. 
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Proof. Suppose P has the property in the hypothesis of the theorem. Dchnc: 

S G Cov*(p) <s> (Vg <p) (((Vr e 9*S*),P(r)) P(g)). 

Then one checks that Cov* is a topology extending C. So by Theorem 13.61 we 
have S g Cov(a) C Cov* (a), from which the desired result follows. □ 

3.3 Formal Baire and Cantor space 

We will write X <N for the set of finite sequences of elements from X. Elements 
of X <N will usually be denoted by the letters u, v,w, . . .. Also, we will write 
u < v if v is an initial segment of u, \v\ for the length of v and u * v for the 
concatenation of sequences u and v. If u G X <fi and q > \u\ is a natural number, 
then we define u[q] by: 

u[q] = {v <E X <N : \v\ = q and v < u}. 

The basis elements of formal Cantor space C are finite sequences u g 2 <N 
(with 2 = {0, 1}), ordered by saying that u < v, whenever v is an initial segment 
of u. Furthermore, we put 

S g Cov(u) & (3q > \u\)u[q] C S 

and BCov(m) = {u[q} : q > \u\}. Note that this will make formal Cantor space 
compact by definition (where a formal space is compact, if for every cover S of 
u there is a K-finite subset a of S such that |a£ Cov(ii)). 

Proposition 3.8 Formal Cantor space is a presentable formal space. 

Proof. We leave maximality and stability to the reader and only check local 
character. Suppose <S* is a sieve on u for which a sieve R g Cov(u) can be found 
such that for all v g R the sieve v*S = (I v) D S belongs to Cov(u). Since 
R G Cov(u) there is q > \u\ such that u[q] C R. Therefore we have for any 
v G u[q] that (4- v) <~] S covers v and hence that there is a r > q such that 
v[r] C S. Since the set u[q] is finite, the elements r can be chosen as a function 
v. For p = max{r„ : v G u[g]}, it holds that 

u \p\ = IJ V \P\ c S, 

v£u[q] 

as desired. □ 

Formal Baire space B is an example of an inductively defined space. The 
underlying poset has as elements finite sequences u G N <N , ordered as for Cantor 
space above. The Grothendieck topology is inductively generated by: 

C{u) = {{u * (n): n G N}}, 
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and therefore we have the following induction principle: 

Corollary 3.9 (Bar Induction for formal Baire space) Suppose P(x) is a prop- 
erty of finite sequences u G N <N , such that 

((Vn G N)P(u*(n))) -> P(u), 

and suppose that S is a cover of v in formal Baire space such that P{x) holds 
for all x £ S. Then P(y) holds. 

Note that this means that Bar Induction for formal Baire space is provable. 
As a special case of Theorem 13.61 we have: 

Corollary 3.10 In CZF + one can show that formal Baire space is presentable. 

In contrast, we observe that formal Baire space cannot be shown to be pre- 
sentable in CZF proper (a proof can be found in Appendix A). 

3.4 Points of a formal space 

The characteristic feature of formal topology is that one takes the notion of 
basic open as primitive and the notion of a point as derived. In fact, the notion 
of a point is defined as follows: 

Definition 3.11 A point of a formal space (P, Cov) is an inhabited subset 
a C P such that 

(1) a is upwards closed, 

(2) a is downwards directed, 

(3) if S G Cov(a) and a G a, then S D a is inhabited. 

We say that a point a belongs to (or is contained in) a basic open p G P if p G a, 
and we will write ext(p) for the class of points of the basic open p. 

If (P, Cov) is a formal space whose points form a set, one can define a new 
formal space pt(P, Cov) = (P p4 , Cov pt ), whose set of basic opens f pt is again P, 
but now ordered by: 

P <pt q ext(p) C ext(g), 
while the topology is defined by: 

S G Covpt(a) <^ ext(a) C (J ext(p). 

pes 
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The space pt(P, Cov) will be called the space of points of the formal space 
(P, Cov). It follows immediately from the definition of a point that 

p < q => p< P tq, 

S e Cov(a) S e Covpt(a). 

The other directions of these implications do not hold, in general. Indeed, if 
they do, one says that the formal space has enough points. It turns out that one 
can quite easily construct formal spaces that do not have enough points (even 
in a classical metatheory). 

Note that points in formal Cantor space are really functions a:N — > {0, 1} 
and points in formal Baire space are functions a: N — s- N. In fact, their spaces 
of points are (isomorphic to) "true" Cantor space and "true" Baire space, re- 
spectively. When talking about such points a we will use a both to denote a 
subset as in Definition 13.111 and a function on N. In particular, the equivalent 
notations 

«ea^tt<ii 

both indicate that u is an initial segment of a. 

The following two results were already mentioned in the introduction and 
are well-known in the impredicative settings of topos theory or intuitionistic set 
theory IZF. Here we wish to emphasise that they hold in CZF as well. 

Proposition 3.12 The following statements are equivalent: 

(1) Formal Cantor space has enough points. 

(2) Cantor space is compact. 

(3) The Fan Theorem: If S is a downwards closed subset o/2 <N and 

(Va € 2 N ) (3u e a) u e S, 
then there is a q G N such that ()[q\ C S. 

Proof. The equivalence of (2) and (3) holds by definition of compactness and 
the equivalence of (1) and (3) by the definition of having enough points. □ 



Proposition 3.13 The following statements are equivalent: 

(1) Formal Baire space has enough points. 

(2) Monotone Bar Induction: If S is a downwards closed subset o/N <N and 

(Va € N N ) {3uea)ueS 
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and 

(Vu £ N <N )(((Vn eN)«*(n)eS)4!ieS) 
ZioZd, i/ien () £ S. 

Proof. (1) (2): If S is downwards closed and satisfies (Va E N N ) (3u E a) u E 
S 1 (i.e., S is a bar), then S E Cov pt (()), by definition. From the hypothesis that 
formal formal Baire space has enough points it then follows that S E Cov(()). 
Hence, if S is inductive as well (i.e., satisfies (Vu E N <N )(((Vn E N) u * (n) £ 
S) — > u E S 1 )), then one may apply Monotone Bar Induction for formal Baire 
space fCorollary |3.9p to deduce that (} E S. 

(2) =>■ (1): Assume that Monotone Bar Induction holds and suppose that S E 
Covpt(()) is arbitrary. We have to show that S E Cov(()). By definition, this 
means that we have to show that ( } E S, where S is inductively defined by the 
rules: _ 

aeS (VrtgN) u*(n)eS 

ae~s ues 

(see the construction just before Lemma l3.5p . However, since S is downwards 
closed (by Lemma l3"3j) . a bar (because S is a bar and S C S) and inductive 
(by construction), we may apply Monotone Bar Induction to S to deduce that 
( ) E S, as desired. □ 



3.5 Morphisms of formal spaces 

Points are really a special case of morphisms of formal spaces. Here we will 
assume that the formal spaces we consider are presentable or at least satisfy 
the additional condition that the collection of basis elements covered by a fixed 
sieve form a set. 

Definition 3.14 A continuous map or a morphism of formal spaces F: (P, Cov) — > 
(Q, Cov') is a subset F C P x Q such that: 

(1) If F(p, q), p' < p and q < q' , then F(p', q'). 

(2) For every p E P there is a cover S E Cov(p) such that each p' E S is 
related via F to some element g' £ Q. 

(3) For every q, q' E Q and element p E P such that F(p, g) and q'), there 
is a cover S E Cov(p) such that every p' E S is related via F to an element 
which is smaller than or equal to both g and q' . 

(4) Whenever F(p, q) and T covers <j, there is a sieve S 1 covering p, such that 
every p' E 5 is related via F to some q' <E T. 

(5) For every g E Q, the set {p : F(p, g)} is closed under the covering relation. 
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In condition (5) we say that a sieve S is closed under covering relation (or simply 
closed), if 

R £ Cov(a),R£ S =>aeS. 

To help the reader to make sense of this definition, it might be good to recall 
some facts from locale theory (see [25] ). A locale is a partially ordered class A 
which has finite meets and small joins, with the small joins distributing over 
the finite meets. In addition, a morphism of locales A —> B is a map B — > A 
preserving finite meets and small joins. 

Every formal space (P, Cov) determines a locale Idl(P, Cov), whose elements 
are the closed sieves on P, ordered by inclusion. Moreover, every morphism of 
locales <p: Idl(P, Cov) Idl(Q, Cov') determines a relation FCPxQbyp£ 
<p(q), with q being the least closed sieve containing q. The reader should verify 
that this relation F has the properties of a map of formal spaces and that every 
such F determines a unique morphism of locales <p: Idl(P, Cov) — > Idl(Q, Cov'). 

Together with the continuous maps the class of formal spaces organises itself 
into a superlarge category, with composition given by composition of relations 
and identity /: (P, Cov) -» (P, Cov) by 

I(p, q) <f=> (3S* E Cov(p)) (W ES)r<q. 

(if the formal space is subcanonical (p =J. p for all p £ P), this simplifies to 
I(p,q) iff p < q). Note that in a predicative metatheory, this category cannot 
be expected to be locally small. 

A point of a formal space (P, Cov) is really the same thing as a map 1 — > 
(P, Cov), where 1 is the one-point space ({*},Cov') with Cov'(*) = {{*}}• 
Indeed, if F: 1 — > (P, Cov) is a map, then a — {p £P: F(*,p)} is a point, and, 
conversely, if a is a point, then 

F(*,p) Oj)£a 

defines a map. Moreover, these operations are clearly mutually inverse. This 
implies that any continuous map F: (P, Cov) — > (Q, Cov') induces a function 
pt(F): pt(P, Cov) — > pt(Q, Cov') (by postcomposition). Since this map is con- 
tinuous, pt defines an endofunctor on the category of those formal spaces on 
which pt is well-defined. 

In addition, we have for any formal space (P, Cov) on which pt is well-defined 
a continuous map F: pt(P, Cov) — > (P, Cov) given by F(p, q) iff ext(p) C ext(g). 
This map F is an isomorphism precisely when (P, Cov) has enough points. (In 
fact, F is the component at (P, Cov) of a natural transformation pt id.) 

3.6 The double of a formal space 

Although the Fan Theorem and Monotone Bar Induction are not provable in 
CZF, we will show below that they do hold as derived rules. For that purpose, 
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we use a construction on formal spaces, which is due to Joyal and which we have 
dubbed the "double construction" @ This construction will enable us to relate 
the sheaf semantics over a formal space to external truth (see part 3 of Lemma 
14. 2[) . The best way to explain it is to consider the analogous construction for 
ordinary topological spaces first. 

Starting from a topological space X, the double construction takes two dis- 
joint copies of X, so that every subset of it can be considered as a pair (U, V) 
of subsets of X. Such a pair will be open, if U is open in X and U C V. Note 
that we do not require V to be open in X: V can be an arbitrary subset of X. 
Therefore the double construction can be seen as a kind of mapping cylinder 
with Sierpihski space replacing the unit interval: the ordinary mapping cylinder 
of a map f:Y — > X is obtained by taking the space [0,1] x Y + X and then 
identifying points (0,y) with f(y) (for all y € Y). The double of a space X is 
obtained from this construction by replacing the unit interval [0, 1] by Sierpihski 
space and considering the canonical map Xdiscr — ► X . 

The construction for formal spaces is now as follows: suppose (U, Cov) is a 
formal space whose points form a set Q. The set of basic opens of £>(U, Cov) = 
(Ud, Cov_d) is 

{D(u):ueV} + {{q}:qeQ}. 

Here both D(u) and {q} are formal symbols for a basic open, representing the 
pairs (u, u) and (0, {q}) in the topological case. The preorder on U_d is generated 
by: 

D(v) < D(u) if v < u in U, 
{q} < D(v) if v G q, 
{p} < {<?} if P = q- 
In addition, the covering relation is given by 

Govu(D(u)) = {{D(v): v £ 5} U {{g} : v G q,v E S} : S £ Cov(m)}, 
Cov D ({q}) = {{q}}. 



Proposition 3.15 T>(V, Cov) as defined above is a formal space, which is pre- 
sentable, whenever (U, Cov) is. 

Proof. This routine verification we leave to the reader. Note that if BCov is a 
presentation for the covering relation Cov, then 

BCov D (D(u)) = {{D(v); v 6 S}: S € Cov(m)}, 
BCov D ({q}) = {{q}} 

is a presentation for Covd. □ 



2 See |33l Section 15.4], This construction is known in the impredicative case for locales, 
but here we wish to emphasise that it works in a predicative setting for formal spaces as well. 
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The formal space T>(U, Cov) comes equipped with three continuous maps. 
First of all, there is a closed map p: (U, Cov) — > £>(U, Cov) given by n(u,p) iff p — 
D(v) for some »eU with I(u,v). In addition, there is a map w: V(U, Cov) — >• 
(U, Cov) given by ir(p, u) iff there is a u G U with u = D(v) and I(v, u). Note 
that 7ro/i = id. And, finally, there is an open map of the form v. (U, Cov)&i Scr — > 
2?(U, Cov). The domain of this map (U, Cov)discr is the formal space whose basic 
opens are singletons {q} (with the discrete ordering) and whose only covering 
sieves are the maximal ones. The map v is then given by v{{q], u) iff u = {q}. 
We depict these maps in the following diagram: 

CD, Cov) > 2?(U, Cov) i (U, Cov) discr 



(U, Cov). 

4 Sheaf models 

In [19] and [12] it is shown how sheaves over a presentable formal space give 
rise to a model of CZF. Moreover, since this fact is provable within CZF itself, 
sheaf models can be used to establish proof-theoretic facts about CZF, such as 
derived rules. We will exploit this fact to prove Derived Fan and Bar Induction 
rules for (extensions of) CZF. 

4.1 Basic properties of sheaf semantics 

We recapitulate the most important facts about sheaf models below. We hope 
this allows the reader who is not familiar with sheaf models to gain the necessary 
informal understanding to make sense of the proofs in this section. The reader 
who wants to know more or wishes to see some proofs, should consult |19j and 

A presheaf X over a preorder P is a functor X:¥ op — > Sets. This means 
that X is given by a family of sets X(p), indexed by elements p 6 P, and a 
family of restriction operations — \ q: X(p) — » X(q) for q < p, satisfying: 

1. — \ p: X(p) — > X(p) is the identity, 

2. for every x S X{p) and r < q < p, (x \ q) \ r — x \ r. 

Given a topology Cov on P, a presheaf X will be called a sheaf, if it satisfies the 
following condition: 

For any given sieve S G Cov(p) and family {x q G X(q) : q G S 1 }, 
which is compatible, meaning that {x q ) \ r = x r for every r < q G 5, 
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there is a unique x G X(p) (the "amalgamation" of the compatible 
family) such that x \ q = x q for all q <E S. 



Lemma 4.1 // a formal space (P, Cov) is generated by a covering system C, 
then it suffices to check the sheaf axiom for those families which belong to the 
covering system. 



Proof. Suppose X is a presheaf satisfying the sheaf axiom with respect to the 
covering system C, in the following sense: 



For any given element a G C(a) and family {x q G X(q) : q G a}, 
which is compatible, meaning that for all r < p,q with p,q € a we 
have (x p ) \ r = (x q ) \ r, there exists a unique x G X(a) such that 
x \ q = x q for all q G a. 



Define Cov* by: 

S G Cov* (a) <^> if b < a and {x q G X(q) : q G b* S} is a compatible family, 
then it can be amalgamated to a unique x G X{b). 

Cov* is a Grothendieck topology, which, by assumption, satisfies 

a G C(a) a G Cov* (a). 

Therefore Cov C Cov*, which implies that X is a sheaf with respect to the 
Grothendieck topology Cov. □ 



A morphism of presheaves F: X — > Y is a natural transformation, meaning 
that it consists of functions {F p : X(p) — > Y(p) :pGP} such that for all q < p 
we have a commuting square: 



Mp) 



The category of sheaves is a full subcategory of the category of presheaves, so 
every natural transformation F: X — > Y between sheaves X and Y is regarded 
as a morphism of sheaves. 

The category of sheaves is a Heyting category and therefore has an "internal 
logic" . This internal logic can be seen as a a generalisation of forcing, in that 
truth in the model can be explained using a binary relation between elements 
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p G P (the "conditions" in forcing speak) and first-order formulas. This forcing 
relation is inductively defined as follows: 



p 


\\-<P A ^ 




p ||— </? and p \\—tp 


p 






{q<p - q IH> or q \\-ip} e Cov(p) 


v 1 


\-cp -> ip 


<^ 


(Vg < p)q [|-</5 =S> (7 ||-V> 




P Ih-L 


<^ 


G Cov(p) 


(3a;: 




<^ 


{g<p: (3a; GX(g))g ||-^)} e Cov(p) 


(Vx: 


A>(x) 




(Vg<p) (VxeX(q))q \\-<p(x) 



Lemma 4.2 Sheaf semantics has the following properties: 

1. (Monotonicity) If p \\— tp and q <p, then q \\—ip. 

2. (Local character) If S covers p and q \\—ip for all q G S, then p \\—ip. 

3. If p is minimal (so q < p implies q—p) and Cav{p) = {{p}}, then forcing 
at p coincides with truth, i.e., we have tp iff p \\—f. 

Proof. By induction on the structure of ip. □ 

Note, in connection with Section 3.6, that every element of the form {q} in 
the double forms a minimal element to which the hypothesis of part 3 of Lemma 
14.21 applies. 

Using this forcing relation, one defines truth in the model as being forced 
by every condition p G P. If P has a top element 1, this coincides with being 
forced at this element (by monotonicity). 

One way to see sheaf semantics is as a generalisation of forcing for classical 
set theory, which one retrieves by putting: 

S G Cov(p) & S is dense below p. 

Forcing for this specific forcing relation validates classical logic, but in general 
sheaf semantics will only validate intuitionistic logic. 

Sheaf semantics as described above is a way of interpreting first-order the- 
ories in a category of sheaves over (P, Cov). To obtain a semantics for the 
language of set theory, one uses the machinery of algebraic set theory and pro- 
ceeds as follows (see [551 HI E])- Let n: E — > U be the universal small map in 
the category of sheaves and let V — W(ir)/ ~ be the extensional (Mostowski) 
collapse of the W-type W — W(ir). Like any W-type, W comes equipped with 
a relation M generated by 

t(e)Msup u (t) 

for any e G E u and t: E u —> W. This relation M descends to a well-defined 
relation on V, which interprets the membership symbol in the language of set 
theory and will be denoted by e. For the resulting model (V, e) we have: 
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Theorem 4.3 If (P, Cov) is a presentable formal space, then sheaf semantics 
over (P, Cov) is sound for CZF, as it is for CZF extended with small W-types 
WS and the axiom of multiple choice AMC. Moreover, the former is provable 
within CZF, while the latter is provable in CZF + WS + AMC. 

Proof. This is proved in [T^MSH] for the general case of sheaves over a site. For 
the specific case of sheaves on a formal space and CZF alone, this was proved 
earlier by Gambino in terms of Heyting- valued models [TH1 US] • O 

Remark 4.4 The requirement that (P, Cov) has a presentation is essential: the 
theorem is false without it (see [20). Therefore we will assume from now on 
that (P, Cov) is presentable. 

For the proofs below we need to compute various objects related to Cantor 
space and Baire space in different categories of sheaves. We will discuss the 
construction of N in sheaves in some detail: this will hopefully give the reader 
sufficiently many hints to see why the formulas we give for the others are correct. 

To compute N in sheaves, one first computes N in presheaves, where it is 
pointwise constant N. The corresponding object in sheaves is obtained by sheafi- 
fying this object, which means by twice applying the plus-construction (the 
standard treatment as in [33] can also be followed in CZF). In case every cov- 
ering sieve is inhabited, the presheaf N is already separated, so then it suffices 
to apply the plus-construction only once. In that case, we obtain: 

N(p) = {{S, <p): S g Cov(p), <p: S -> N compatible}/ ~, 

with (S, <p) ~ (T, ip), if there is an R £ Cov(p) with R C S (IT and tp(r) = ip(r) 
for all reR, and (S, if) \ q = (q*S, if \ q*S). 

Remark 4.5 If P has a top element 1 (as often is the case), then elements of 
N(l) correspond to continuous functions 

(P,Cov) -^N dlscr . 

Remark 4.6 Borrowing terminology from Boolean- valued models [7], we could 
call elements of N(p) of the form (M p , tp) pure and others mixed (recall that 
M p =4- p is the maximal sieve on p). As one sees from the description of N 
in sheaves, the pure elements lie dense in this object, meaning that for every 
x e N(p), 

{q < p: x \ q is pure} € Cov(p). 

This, together with the local character of sheaf semantics, has the useful conse- 
quence that in the clauses for the quantifiers 

p \\-(3x e N) <p(x) ^ {q <p: (3x e N(q)) q \\-tp(x)} e Cov(p) 
p ]| — (Va; G N) <p(x) & (Vg < p) (Vx e N(q)) q \\-<p(x) 
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one may restrict one's attention to those x G N(q) that are pure. 



We also have the following useful formulas: 



2(p) 


- {(S,<p) 


2 <N (P) 


= 2(p)< N , 


2 N b) 


= 2( P f, 


N <N (p) 


= N(p) <N 


N N (p) 


= N(p) N . 



All these objects come equipped with the obvious equivalence relations and 
restriction operations. We will not show the correctness of these formulas, which 
relies heavily on the following fact: 

Proposition 4.7 [261 Proposition III. 1, p. 136] The sheaves form an exponen- 
tial ideal in the category of presheaves, so if X is a sheaf and Y is a presheaf 
then X Y ( as computed in presheaves ) is a sheaf. 

From these formulas one sees that, if P has a top element 1, then 2 N (1) can be 
identified with the set of continuous functions (P, Cov) — » C to formal Cantor 
space and N N (1) with the set of continuous functions (P, Cov) — > B to formal 
Baire space. Also, in 2 <N and N <N the "pure" elements are again dense. (But 
this is not true for 2 N and N N , in general.) 



4.2 Choice principles 

For our purposes it will be convenient to introduce the following ad hoc termi- 
nology. 

Definition 4.8 A formal space (P, Cov) will be called a CC-space, if every cover 
has a countable, disjoint refinement. This means that for every S S Cov(p), 
there is a countable a C S such that J.a G Cov(p) and for all p,q G a, either 
p = q or 4- p H 4 q = 0. 

Example 4.9 Formal Cantor space is a CC-space and if AC^ holds, then so is 
formal Baire space (see Proposition IB.4)) . Also, doubles of CC-spaces are again 
CC. 

Our main reason for introducing the notion of a CC-space is the following 
proposition, which is folklore (see, for instance, [21]): 

Proposition 4.10 Suppose (P, Cov) is a presentable formal space which is CC. 
//DC or AC u holds in the metatheory, then the same choice principle holds in 
Sh(P, Cov). Moreover, this fact is provable in CZF. 
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Proof. We check this for AC W , the argument for DC being very similar. So 
suppose X is some sheaf and 

p ||— (Vn £ N)(3a; G X)<p(n,x). 

Using that the pure elements in N are dense (Remark 14. 6|) . this means that for 
every n G N there is a cover S G Cov(p) such that for all q G S there is an 
x G X(q) such that 

q \\-<p(n,x). 

Because the space is assumed to be CC we have S =1 a for a set a which is 
countable and disjoint. Furthermore, since AC U holds, the x G X(q) can be 
chosen as a function of n G N and q G a. As a is disjoint, we can therefore 
amalgamate the x q _ n G X(q) to an element x n G X(p) such that 

P \\-(fi(n,x n ). 

So if we set f(n) — x n we obtain the desired result. □ 

5 Main results 

In this final section we present the main results of this paper: the validity of 
various derived rules for CZF and its extension of the form CZF + . A system of 
a slightly different kind to which these results apply as well will be discussed in 
Appendix B. The proofs are based on the fact that an appropriate predicative 
formulation of sheaf semantics can be proved inside CZF to be sound for CZF, 
together with the special features of the double construction mentioned after 
Lemma 14.21 

Theorem 5.1 (Derived Fan Rule) Suppose <p(x) is a definable property of ele- 
ments u G 2 <N . If 

CZF h (Vq G 2 n ) (3u G 2 <n ) (a G u Acp(u)) and 
CZF h (Vue2 <N )(\/ve2 <N ){v<uAtp{u)^ip(v)), 

then CZF h (3n G N) (Vu G {)[n])cp(v). 

Proof. We work in CZF. We pass to sheaves over the double of formal Cantor 
space T>(C), where there is a global section it of the exponential sheaf 2 N defined 
by letting 7r(n) be the equivalence class of 

(OM.Asc G (>[n].x(n)). 

Under the correspondence between such global sections with continuous func- 
tions 2?(C) — > C, this is precisely the map n from Section 3.7 (second map in 
the list). 
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From 

Sh(X>(C)) h (Va G 2 N ) (3u G 2 <N ) (a G u A p(u)), 

it follows that 

£>((» ||-(3uG2 <N )(7rGuA^(u)). 

Sheaf semantics then gives one a natural number n such that for every v G ( ) [n] 
there is a section r„ G 2 <N (Z?(?;)) such that 

D{v) ||-7r G r„ A p(t„). 

By choosing a larger n if necessary, one may achieve that the t v are pure, i.e., 
of the form (M v , u v ). We will prove that this implies that <p(v) holds. 

From 

D(v) || — vr G r„, 
it follows that v < u v . Then validity of 

(Vu G 2 <N ) (Vu G 2 <N ) (t<wA p(u) -> p(«)) 

implies that D(v) \\— f(v). By picking a point a G u and using the monotonicity 
of forcing, one gets {a} \\—<p(v), and hence (p(v) by part 3 of Lemma l4~2l □ 



Remark 5.2 By using the fact that CZF has the numerical existence property 
[30] we see that the conclusion of the previous theorem could be strengthened 
to: then there is a natural number n such that CZF h (Vu G ()[n]) (p(v). 
Indeed, there is a primitive recursive algorithm for extracting this n from a 
formal derivation in CZF. 



Remark 5.3 It is not hard to show that CZF proves the existence of a definable 
surjection 2 N — > [0, l]cauchy from Cantor space to the set of Cauchy reals lying 
in the unit interval. This, in combination with Theorem 15.11 implies that one 
also has a derived local compactness rule for the Cauchy reals in CZF. It also 
implies that we have a local compactness rule for the Dedekind reals in CZF + 
AC W and in CZF + DC, because both AC U and DC are stable under sheaves 
over the double of formal Cantor space (see Proposition 14. 10[) and using either 
of these two axioms, one can show that the Cauchy and Dedekind reals coincide. 

Recall that we use CZF + to denote any theory extending CZF which allows 
one to prove set compactness and which is stable under sheaves. 

Theorem 5.4 (Derived Bar Induction Rule) Suppose tp(x) is a formula defining 

G N <N )(a G uA<p(u)) and 
! G N <N ) (v <uA ip(u) -> (f(v)) and 
'n G N) ip(u * n) — > <p(u)), 



a subclass of N <N 


■ V 






CZF+ h 


(Va 


G 


N N ) 


CZF+ h 


(Vu 


G 


n <n ; 


CZF+ h 


(Vu 


G 


N <N- 


then CZF+ h tp({ 


))• 
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Proof. We reason in CZF+. We pass to sheaves over the double of formal 
Baire space 2?(B), where there is a global section ir of the sheaf N N defined by 
letting 7r(n) be the equivalence class of 

(Q[n],\x G ()[n].x(n)) 

(which corresponds to the "projection" 2?(B) — > B, as before). From 

Sh(X>(B)) h (Va G N N ) (3m g N <n ) («6uA tp(u)), 

one gets 

£>(()) \\-(3ueN <N )(Tr euAip(u)). 

By the sheaf semantics this means that there is a cover S of ( ) in formal Baire 
space B such that for every v G S there is a pure it G N <N such that 

D(v) j— 7r G u A <£>(w). 

Now D(v) 1 1 — -71" G u implies v < u and because sheaf semantics is monotone this 
in turn implies D(v) \\—tp(v). By choosing a point a G u and using monotonicity 
again, one obtains that {a} \\—cp(v), and hence </?(i>) by part 3 of Lemma 14.21 

Summarising: we have a cover S such that for all v G S the statement ip(v) 
holds. Hence </?(()) holds by Corollary 13. 91 □ 



Theorem 5.5 (Derived Continuity Rule for Baire Space) Suppose <p(x, y) is a 
formula defining a subset o/N N x N N . //CZF+ h (Va G N N ) (310 G N N ) <p(a, /3), 

CZF+ h (3/:N N -> N N ) [((Va G N N ) (f(cx, /(a))) A / continuous}. 

Proof. Again, we work in CZF + and pass to sheaves over the double of formal 
Baire space f (B), where there is a global section of the sheaf N N , namely the 
projection tt: T>(B) — > B. Since 

Sh(2?(B)) h(3!/3GN N )^(7r,/3), 

there exists a unique function p: £>(B) — > B (and global section of N N ) such that 

D(())\-<p(ir,p). 

Consider the maps p: B — >• 2?(B) and v. Hdiscr ^(B) from Section 3.7. 
The continuity of p implies that pt(pfi) = pt(pv):N N N N ; writing / = 
pt(pp), one sees that /:N N —> N n is continuous. Moreover, if a G N N , then 
{a} ||-<p(pt(7r)(a),pt(p)(a)), i.e. {a} \\-(p(a, /(a)), and hence ip(a,f(a)). □ 

These proofs can be adapted in various ways to prove similar results for 
(extensions of) CZF, for instance: 
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- Thcorem l5.ll holds for any extension of CZF which is stable under sheaves 
over the double of formal Cantor space, such as the extension of CZF with 
choice principles like DC or AC W (because of Proposition 14. 101) . 

- For the same reason Theorem 15.41 and Theorem 15.51 remain valid if we 
extend CZF + with choice principles. These results also hold for the theory 
CZF + AC W + "The Brouwer ordinals form a set" (see Appendix B). 

- The same method of proof as in Theorem 15.51 should establish a derived 
continuity rule for the Dedekind reals and many other definable formal 
spaces. 

A Independence of presentability of formal Baire 
space in CZF 

The aim of this appendix is to show that CZF does not prove the existence of a 
presentation of formal Baire space. For this purpose, we use forcing over a site 
as in [12] rather than forcing over a formal space. Recall that in [TJ] we showed 
that what happens when one does forcing over a site is completely analogous 
to what happens when one does forcing over a formal space: it leads, provably 
in CZF, to a sound semantics of CZF, as long as the site is assumed to have a 
presentation (see [H] for the definition of a presentation for a site). 

Let S be a small category of formal spaces and continuous maps, whose 
objects are basic open subsets of B™ of the form B{u\) x . . . x B(u n ) (where 
ui, . . . ,u n £ N <N and we write B(u) for the basic open determined by the fi- 
nite sequence it) and whose maps contain the inclusions between open subsets 
and the projections. (For example, § could be given by these objects and all 
continuous maps between them.) Equip S with the Grothendieck topology in- 
duced by the open covers of the formal space § and the projections (the latter 
are automatically included if, for example, constant maps are included so that 
projections have sections in 8). 

Lemma A.l //B has a presentation, then so does S. 

Proof. This is clear from the fact that if B has a presentation, so does each 
B(ui) x ... x B(u n ). In fact, to be explicit, for X = B(u\) x . . . x B(u n ) the 
formula 

BCov s (X) = { {Ui x Yi -> X} : Y t e S, {Ui} € BCov B{ui)x ... xB{Un) (X) } 
defines a presentation of S. □ 

By the lemma it follows that if B has a presentation, the sheaves on the site 
§ provide a model for CZF. We observe the following property of the model: 
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Proposition A. 2 (See [T5] and [33J Section 15.6].) Assume B has a presenta- 
tion. Then Monotone Bar Induction holds in the CZF '-model given by sheaves 
on S. 

Corollary A. 3 The theory CZF + DC does not prove that B has a presen- 
tation. 

Proof. If CZF + DC would prove that B has a presentation, then, by the 
proposition, this would imply that the consistency of CZF + DC implies the 
consistency of CZF + Monotone Bar Induction. But the latter is known to 
have greater proof-theoretic strength (see [3T]). □ 

Proof. (Of Proposition E2) Suppose X G S and S G Pow(N <N )(X) is a 
(small) subsheaf of N <N which forms an "internal bar"; i.e., 

(1) X II— (Va G N N ) (3n e N) (a(0), . . . , a(n)) G S, 

(2) X \\-(Vu,v eN <N )(u<v Av eS^ueS), 

(3) X ||-(Vu G N <N ) ((Vn G N)u * (n) G S -> u £ 5). 

The projection 7r2: X x B — >• B at the stage 7Ti: X x B — >• X over X represents 
a (generic) element of the sheaf N N , and (1) implies 

XxB ||-(3neN) (7r 2 (0),...,7r 2 (n)) G S. 

By definition, this means that there is a cover of X x B by basic opens U% x B(vi) 
such that for each i we have that 

(4) (3neN)f/,x%) ||-(7r 2 (0),...,7r 2 (n)) G5 

(where we simply write S for the restriction of S along Ui x B(vi) — > Ui C X). 
We claim that we can choose the cover Ui x B{v{) in such a way that for each 
i it holds that 

(5) Ui \\-Vi G 5. 

Indeed, if we can choose the n in (4) such that n < \vi\, then (4) implies (5) by 
assumption (2) on S. On the other hand, if (4) holds for n > we can replace 
the single element Ui x B(vi) in the cover by all elements of the form Ui x B{w) 
where w is an extension of Vi of length n. Then Ui x B(w) \\—w G 5 by (4) and 
monotonicity of forcing, hence Ui \\—w G S because projections cover. 

Let 

W = { U X B(v) ES-.UCX open, v G N <N and U \\-v eS}. 

Then W covers X x B as we have just seen. Moreover, if any [/ x B(v) is covered 
by elements of W then it belongs to W. Indeed, to show this it suffices to prove 
the following two properties: 
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(6) If {Ui} covers U and U t x B(v) E W, then U x E W. 

(7) If f7 x B(u * (n)) G W for each n, then [/ x B{v) E W. 

But (6) holds by the local character of forcing, while (7) holds by assumption 
(3) on S. By induction on covers f Theorem 13. 7p we conclude that X ||— (} E S, 
which completes the proof. □ 



B Brouwer ordinals 

Recall that we defined CZF + to be any extension of CZF in which the set 
compactness theorem is provable and which is stable under sheaves. We do 
not expect that CZF + AC W + "The Brouwer ordinals form a set" is such a 
theory CZF + . Nevertheless, our main results apply to this theory as well. To 
show this, we have to prove (1) that this theory proves that formal Baire space 
is presentable and (2) that this theory is stable under taking sheaves over the 
double of formal Baire space. In this appendix we work out the details. 

First, we recall the definition of the Brouwer ordinals. 

Definition B.l The class BO of Brouwer ordinals is the smallest class closed 
under the rules: 

* E BO, 
t: N ->• BO => sup(i) E BO. 

In other words, it is the W-type associated to the constant map N — > 2 with 
value 1 or the initial algebra for the functor F(X) = 1 + X N (see [28] V 

Our proof that the theory CZF + AC W + "The Brouwer ordinals form a 
set" shows that formal Baire space has a presentation, is based on an alternative 
description of formal Baire space. For this, define BCov(( )) be smallest subclass 
of Pow(N <N ) such that: 

{()}eBCov(()) 

Vi E N: Si E BCov(()) U 4eN (*> * S t E BCov({}) 

This inductive definition makes sense in CZF even when the Brouwer ordinals 
only form a class. 

Lemma B.2 If BO is a set, then so is BCov({)). 

Proof. Define a map k: BO — > Pow(N <N ) by recursion: 

*(*) = {<)}, 
fc(sup(i)) = U <*>**(*)• 
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Its image is BCov((}) and therefore it follows from replacement that it is a set, 
if BO is a set. □ 



Put: 

5 £ BCov(u) «• 3T e BCov(()):w*T G BCov(u) 
5 G Cov(w) » 3Te BCov(w): T C S. 

Lemma B.3 1. Every T G BCov(w) is countable. 

2. Suppose R v G BCov(u) is a collection of basic covering sieves indexed by 
elements v from a sieve T. IfT belongs to BCov(u) then so does {J veT R v - 

3. If T G BCov(u) and v < u, then there is an S G BCov(w) such that 
S C v* |T. 

Proof. It suffices to prove these statements in the special case where u = (}; 
in that case, they follow easily by induction on T. □ 

Proposition B. 4 (AC W ) (N <N ,Cov) as defined above is an alternative de- 
scription of formal Baire space and therefore formal Baire space is presentable 
whenever the Brouwer ordinals form a set. 

Proof. We begin by showing that (N <N , Cov) is a formal space. Since maximal- 
ly is clear and stability follows from item 3 of the previous lemma, it remains 
to check local character. 

Suppose S is a sieve on u and there is a sieve R G Cov(u) such that for all v G R 
the sieve v*S belongs to Cov(u). Since R G Cov(u) there is a T G BCov(m) such 
that T C R. Therefore we have for any v G T that v*S covers v and hence that 
there is a Z G BCov(w) such that Z C S. Since T is countable, we can use AC W 
or the finite axiom of choice (which is provable in CZF) to choose the elements 
Z as a function Z v of v G T. Then let K = [J veT Z v . K is covering by the 
previous lemma and because 

K = (J Z V C S, 

veT 

the same must be true for S. 

It now follows from the discussion preceeding the definition of BCov(w) above 
that each BCov(u) will be a set, if the Brouwer ordinals form a set. Hence the 
formal space (N <N , Cov) will be presentable if BO is a set. 

To easiest way to prove that we have given a different presentation of formal 
Baire space is to show that Cov is the smallest topology such that 

|{ii*(n):neNje Cov(m). 
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Clearly, Cov has this property, so suppose Cov* is another. One now shows by 
induction on T G BCov(m) that J, Cov* (it). This completes the proof. □ 



Corollary B.5 The theory CZF+DC does not prove that the Brouwer ordinals 
form a set. 

Proof. Because this theory does not prove that formal Baire space has a pre- 



It will follow from the next theorem, whose proof will take the remainder 
of this appendix, that CZF + AC U + "The Brouwer ordinals form a set" is 
a theory which is stable under taking sheaves over the double of formal Baire 
space. 

Theorem B.6 Let (P, Cov) be a presentable formal space which is CC. Then 
the combination of AC W and smallness of the Brouwer ordinals implies their 
joint validity in Sh(P, Cov). 

In view of Proposition 14. 101 it suffices to show that the Brouwer ordinals are 
small in Sh(P, Cov). To that purpose, we will give an explicit construction of 
the Brouwer ordinals in this category, from which it can immediately be seen 
that they are small (the description is a variation on those presented in |10j and 



Let V be the class of all well-founded trees, in which 

• nodes are labelled with triples (p, a, ip) with p an element of P, a a count- 
able and disjoint subset of 4- P such that j a 6 Cov(p) and tp a function 

{0,1}, 

• edges into nodes labelled with (p, a, ip) are labelled with pairs (q, n) with 
q G a and n G N, 

in such a way that 

• if a node is labelled with (p, a, ip) and q G a is such that <p{q) = 0, then 
there is no edge labelled with (q, n) into this node, but 

• if a node is labelled with (p, a, ip) and q G a is such that ip(q) = 1, then 
there is for every n G N a unique edge into this node labelled with (q, n). 

Using that the Brouwer ordinals form a set, one can show also that V is a set. If 
v denotes a well-founded tree in V, we will also use the letter v for the function 
that assigns to labels of edges into the root of v the tree attached to this edge. 




□ 
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So if (q, n) is a label of one of the edges into the root of v, we will write v(q, n) 
for the tree that is attached to this edge; this is again an element of V. Note 
that an element of V is uniquely determined by the label of its root and the 
function we just described. 

We introduce some terminology and notation: we say that a tree v E V is 
rooted at an element p in P, if its root has a label whose first component is p. 
A tree v E V whose root is labelled with (p, a, ip) is composable, if for any (q, n) 
with q E a and <p(q) = 1, the tree v(q, n) is rooted at q. We will write W for the 
set of trees that are hereditarily composable (i.e. not only are they themselves 
composable, but the same is true for all their subtrees). 

Next, we define by transfinite recursion a relation ~on V: 

v <~ v' ^ If the root of v is labelled with (p, a, <p) and the root 
of v' with (p', a' ,<p'), then p — p' and p is covered by 
those r < p for which there are (necessarily unique) 
q E a and q' E a' such that (1) r < q and r < q' , 
(2) <p(q) = ip'(q') and (3) ip(q) = ip'(q') = 1 implies 
v(q,n) ~ v'(q',n) for all n E N. 

By transfinite induction one verifies that ~ is an equivalence relation on both 
V and W. Write BO for the quotient of W by ~. The following sequence of 
lemmas establishes that BO can be given the structure of a sheaf and is in fact 
the object of Brouwer ordinals in the category of sheaves. 

Lemma B.7 BO can be given the structure of a presheaf. 

Proof. Since by definition of ~, all trees w E W in an equivalence class are 
rooted at the same element, we can say without any danger of ambiguity that 
an element w E BO is rooted at p E P. We will denote the collection of trees in 
BO rooted at p by BO(p). 

Suppose [w] E W(p) and q < p. If the root of w is labelled by (p, a, <p), then 
there is a countable and disjoint refinement [3 of q* 4- ct (by stability and the 
fact that (P, Cov) is a CC-space). For each r E (3 there is a unique q E a such 
that r < q (by disjointness), so one can define if): (3 — > {0,1} by tp{r) = ip(q) 
and, whenever tp(r) = ip(q) = 1, v(r, n) = w(q,n). The data (q,(3,ip) and v 
determine an element w' E W(q) and we put 

[w] \ q = [w']. 

One easily verifies that this is well-defined and gives BO the structure of a 
presheaf. □ 



Lemma B.8 BO is separated. 
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Proof. Suppose T is a sieve covering p and w,w' £ W(p) are such that [w] \ 
t = [w 1 ] \ t for all t £ T. We have to show w ~ u/, so suppose (p, a, <p) is the 
label of the root of io and (p', a',ip') is the label of the root of w' . Since u/ is 
rooted at p', we have p — p' . 

Let i? consist of those r £ (| a)n(|a'), for which there are ijea and g' e a' 
such that (1) r < q,q', (2) ip(q) = ip'(q') and (3) ip(q) = <f'(q') = 1 implies 
w(q, n) ~ n) for all n £ N. i? is a sieve, and the statement of the lemma 

will follow once we show that it is covering. 

Fix an element t £ T. Unwinding the definitions in [w] \ t = [w'] \ t gives us 
the existence of a covering sieve S C t*(J. a) n t*(l a') such that S C So 
R is a covering sieve by local character. □ 



Lemma B.9 BO is a sheaf. 



Proof. Let S be a covering sieve on p and suppose we have a compatible family 
of elements (w q S BO) qe s- Let a be a countable and disjoint refinement of S 
and use AC U to choose for every element q £ a a representative (w 9 € W),j eQ 
such that [wg] = w q . For every q £ a the representative w q has a root labelled 
by something of form (q 7 f3 q ,Lp q ). If we put f3 = \J qea P q , then (3 is countable 
and disjoint and I /3 covers p (by local character). If r £ f3, then there is a 
unique q £ a such that r £ f3 q (by disjointness), so therefore it makes sense to 
define ip(r) = tp q (r) and w(r, n) — w q (r, n). 

We claim the element [w] £ BO determine by the data (p, (3, if) and the func- 
tion w just defined is the amalgamation of the elements (w q £ BO) q es- To that 
purpose, it suffices to prove that [w] \ q = w q = [w q ] for all q £ a. This is not 
hard, because if q £ a and r £ f3 q , then w(r,n) = w q (r,n), by construction. 
This completes the proof. □ 



Lemma B.10 BO is an algebra for the functor F(X) = 1 + X fi . 

Proof. We have to describe a natural transformation sup: F(BO) — > BO, i.e., 
a natural transformation 1 — > BO and a natural transformation BO N —> BO. 
For the natural transformation 1 — s> BO, we define sup p (*) on * £ l(p) to 
be the equivalence class of the unique element in W determined by the data 
(p,{p},ip) with if(p) = 0. To define the natural transformation BO N BO 
on t:N — > BO(p), we use AC W to choose a function t:N — > W(p) such that 
[t(nj\ = t(n) for all n £ N. Then we define sup p (t) to be the equivalence 
class of the element w determined by the data (p, {p}, ip) with <f(p) = 1 and 
w(p,n) = t(n). We leave the verification that this makes sup well-defined and 
natural to the reader. □ 
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Lemma B.ll BO is the initial algebra for the functor F(X) = 1 + X N . 

Proof. Wc follow the usual strategy: we show that sup: F(BO) — > BO is monic 
and that BO has no proper F-subalgebras (i.e., we apply Theorem 26 of [5]). It 
is straightforward to check that sup is monic, so we only show that BO has no 
proper F-subalgebras, for which we use the inductive properties of V. 

Let / be a sheaf and F-subalgebra of BO. We claim that 

J = {v G V : if v is hereditarily composable, then [v] G /} 

is such that if all immediate subtrees of an element v £ V belong to it, then so 
does v itself. 

Proof: Suppose v G V is a hereditarily composable tree such that all its imme- 
diate subtrees belong to J. Assume moreover that (p, a, if) is the label of its 
root. We know that for all n G N and q G a with <p(q) = 1, [v(f, y)\ G I and our 
aim is to show that [v] G /. 

For the moment fix an element q G a. Either ip(q) = or <p(q) = 1. If <p(q) = 0, 
then [v] \ q equals sup g (*) and therefore [v] \ q G /, because / is a F-algebra. 
If ip(q) — 1, then we may put t(n) = [v(q,n)] and [v] \ q will equal sup g (t). 
Therefore [v] \ q G /, again because J is a F-algebra. So for all q G a we have 
[v] \ q G I. But then it follows that [v] G /, since J is a sheaf. 

We conclude that J — V and I = BO. □ 

This completes the proof of the correctness of our description of the Brouwer 
ordinals in a category of sheaves and thereby of Theorem IB. 61 
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